First Last Prev Next    This bug is not in your last search results.
Bug 1060176 - (CVE-2017-14682) VUL-0: CVE-2017-14682: ImageMagick: GetNextToken in MagickCore/token.c heap buffer overflow could lead to denial of service
(CVE-2017-14682)
VUL-0: CVE-2017-14682: ImageMagick: GetNextToken in MagickCore/token.c heap b...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/192374/
CVSSv2:NVD:CVE-2017-14682:6.8:(AV:N/A...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2017-09-25 08:41 UTC by Victor Pereira
Modified: 2017-12-22 23:38 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2017-09-25 08:41:10 UTC 
CVE-2017-14682

GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers
to cause a denial of service (heap-based buffer overflow and application crash)
or possibly have unspecified other impact via a crafted SVG document, a
different vulnerability than CVE-2017-10928.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14682
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14682.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14682
https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32726
https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32726
Comment 1 Marcus Meissner 2017-09-29 13:02:15 UTC 
heap write overflow. needs fix.
Comment 3 Petr Gajdos 2017-11-29 16:11:56 UTC 
I do not get any valgrind error anywhere.
Comment 4 Petr Gajdos 2017-11-30 18:00:05 UTC 
42.3/GraphicsMagick code in utility.c:

    if ((LocaleNCompare(token,"url(#",5) == 0) &&
        ((r = strrchr(token,')')) != NULL))
      {
        *r='\0';
        (void) memmove(token,token+5,r-token+1);
      }


In my opinion not affected. Similarly to 11/GraphicsMagick and 11/ImageMagick.

Only 12/ImageMagick seem to be affected. However, gdb does not stop inside the offended if block for this testcase. But I guess the check is worth to add.
Comment 5 Petr Gajdos 2017-11-30 18:31:43 UTC 
(In reply to Petr Gajdos from comment #4)
> 42.3/GraphicsMagick code in utility.c:
> 
>     if ((LocaleNCompare(token,"url(#",5) == 0) &&
>         ((r = strrchr(token,')')) != NULL))
>       {
>         *r='\0';
>         (void) memmove(token,token+5,r-token+1);
>       }

Although .. the code does not be correct as well. memmove() copies too much if I understand correctly. I will notify GraphicsMagick upstream.
Comment 6 Petr Gajdos 2017-11-30 19:24:12 UTC 
Will submit for:
12/ImageMagick, 42.3/GraphicsMagick and 42.2/GraphicsMagick(In reply to Petr Gajdos from comment #5)
> (In reply to Petr Gajdos from comment #4)
> > 42.3/GraphicsMagick code in utility.c:
> > 
> >     if ((LocaleNCompare(token,"url(#",5) == 0) &&
> >         ((r = strrchr(token,')')) != NULL))
> >       {
> >         *r='\0';
> >         (void) memmove(token,token+5,r-token+1);
> >       }
> 
> Although .. the code does not be correct as well. memmove() copies too much
> if I understand correctly. I will notify GraphicsMagick upstream.

Well, probably not worth the effort .. null char injected .. few bytes read potentially past allocated memory.
Comment 7 Petr Gajdos 2017-11-30 19:24:33 UTC 
Summary:
12/ImageMagick affected.
Comment 8 Petr Gajdos 2017-12-01 11:41:35 UTC 
I believe all fixed.
Comment 10 Swamp Workflow Management 2017-12-20 17:39:41 UTC 
SUSE-SU-2017:3388-1: An update that solves 32 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1048457,1049796,1050083,1050116,1050139,1050632,1051441,1051847,1052450,1052553,1052689,1052744,1052758,1052764,1054757,1055214,1056432,1057157,1057719,1057729,1057730,1058485,1058637,1059666,1059778,1060176,1060577,1061254,1062750,1066003,1067181,1067184,1067409
CVE References: CVE-2017-11188,CVE-2017-11478,CVE-2017-11523,CVE-2017-11527,CVE-2017-11535,CVE-2017-11640,CVE-2017-11752,CVE-2017-12140,CVE-2017-12435,CVE-2017-12587,CVE-2017-12644,CVE-2017-12662,CVE-2017-12669,CVE-2017-12983,CVE-2017-13134,CVE-2017-13769,CVE-2017-14138,CVE-2017-14172,CVE-2017-14173,CVE-2017-14175,CVE-2017-14341,CVE-2017-14342,CVE-2017-14531,CVE-2017-14607,CVE-2017-14682,CVE-2017-14733,CVE-2017-14989,CVE-2017-15217,CVE-2017-15930,CVE-2017-16545,CVE-2017-16546,CVE-2017-16669
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.17.1
Comment 11 Andreas Stieger 2017-12-22 15:58:16 UTC 
done
Comment 12 Swamp Workflow Management 2017-12-22 20:15:25 UTC 
openSUSE-SU-2017:3420-1: An update that solves 32 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1048457,1049796,1050083,1050116,1050139,1050632,1051441,1051847,1052450,1052553,1052689,1052744,1052758,1052764,1054757,1055214,1056432,1057157,1057719,1057729,1057730,1058485,1058637,1059666,1059778,1060176,1060577,1061254,1062750,1066003,1067181,1067184,1067409
CVE References: CVE-2017-11188,CVE-2017-11478,CVE-2017-11523,CVE-2017-11527,CVE-2017-11535,CVE-2017-11640,CVE-2017-11752,CVE-2017-12140,CVE-2017-12435,CVE-2017-12587,CVE-2017-12644,CVE-2017-12662,CVE-2017-12669,CVE-2017-12983,CVE-2017-13134,CVE-2017-13769,CVE-2017-14138,CVE-2017-14172,CVE-2017-14173,CVE-2017-14175,CVE-2017-14341,CVE-2017-14342,CVE-2017-14531,CVE-2017-14607,CVE-2017-14682,CVE-2017-14733,CVE-2017-14989,CVE-2017-15217,CVE-2017-15930,CVE-2017-16545,CVE-2017-16546,CVE-2017-16669
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-40.1
openSUSE Leap 42.2 (src):    ImageMagick-6.8.8.1-30.12.1
First Last Prev Next    This bug is not in your last search results.